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SUMMARY 


A vector-based failure detection and isolation technique, which can 
provide dual fail-operational capability for a redundant strapdown inertial 
measurement unit over all aircraft operating environments, is developed. 

The inertial sensors are skewed in a semi-octahedral array of four two 
degree-of-freedom gyros and accelerometers. Failure detection is based on 
comparison of parity equations with a threshold, and isolation is based on 
comparison of logic variables which are keyed to pass/fail results of the 
parity test. 

Since the inertial measurement unit provides flight control, display, 
and navigation data, a multi-level approach to failure detection is used to 
ensure adequate coverage for these avionics functions. Sensor error models 
are introduced to expose the susceptibility of the parity equations to 
sensor errors and physical separation effects such as lever-arm 
acceleration. The threshold function, which is comprised of static and 
dynamic sensor errors and separation effect compensation terms, is derived 
for accelerometers. The failure detection and isolation algorithm is 
evaluated in a simulation of a commercial transport operating in a range of 
light to severe turbulence environments. A bias-jump failure level of 0.2 
deg/hr inserted in the gyro data was detected and isolated properly in the 
light and moderate turbulence environments, but not detected in the extreme 
turbulence environment. An accelerometer bias-jump failure level of 1.5 
milli-g was detected over all turbulence environments. For both types of 
inertial sensor, hard-over and null type failures were detected in all 
environments without incident. The algorithm functioned without false alarm 
or false isolation over all turbulence environments for the runs tested. 

Dual fail-operational capability for the redundant strapdown inertial 
measurement unit was demonstrated with the use of the algorithm. 


INTRODUCTION 

Integrated avionics concepts for commercial aircraft use strapdown 
inertial sensors for angular rate and linear acceleration measurements for 
generation of aircraft states for guidance and control laws, display, and 
navigation systems. To meet safety and reliability requirements triply 
redundant IMU's have been used in the design of operational systems. 

Future aircraft designs, however, will stress maximum efficiency through 
relaxed static stability and require flight crucial information from the 
inertial sensors for integrated avionics functions. Reliability and safety 
issues for these aircraft will mandate automatic selection of operational 
sensors with quick rejection of failed components so that flight control, 
display, or navigation functions will not be impaired. Accordingly, 
research at NASA Langley Research Center has been directed toward fault 
tolerant concepts for inertial sensor arrays. Cost considerations, however, 
restrict the system complexity and number of inertial sensors available to 
generate required flight crucial data. This implies the use of an optimum 
geometric array of sensors with efficient failure detection and isolation 
(FDI) and redundancy management (RM) algorithms to satisfy reliability and 
safety requirements (ref. 1). The purpose of this paper is to report on the 
development of a vector-based technique for redundancy management of a 



skewed array of inertial sensors to enable a fail-operational/fail- 
operational/fail-safe capability meeting appropriate reliability and safety 
requirements. 

To develop and evaluate redundancy management algorithms, Langley 
Research Center has designed and built an experimental, redundant strapdovn 
inertial measurement unit (RSDIHU). The unit consists of a separable and 
communicating semi-octahedral array of four two degree-of-freedom (TDOF) 
gyros and four TDOF accelerometers (ref. 2). Because of widely varying 
reliability and performance requirements among the flight control, display, 
and navigation systems, and to account for a wide variety of sensor 
uncertainties and anomalies, this FDI design has been based on a multi-level 
structure (ref. 3). Accordingly, this report will show the development of a 
multi-level FDI algorithm which will provide dual fail-operational 
performance capability for the RSDIMU for flight control, display, and 
navigation systems. 

The detection and isolation of failures of the separated RSDIMU is 
accomplished by comparing a function of the sensor outputs against a 
threshold. For failures which affect flight control, comparing a function 
of the sensor outputs against a threshold is sufficient. For systems 
requiring more accurate sensor data, such as display and navigation 
functions, the process is more complicated. That is, the failure thresholds 
must be compensated for normal sensor errors, such as scale factor and 
misalignment errors, which are large during aircraft maneuvers; also 
separation effect terms, such as lever-arm acceleration differences between 
sensors must be compensated for. In references 4 and 5 techniques are 
discussed for the generation of thresholds to account for the effects of 
dynamic sensor errors and sensor separation. A technique to provide 
separation effect compensation was developed in reference 6; however, it 
does not provide dual fail-operational capability. These analyses were 
performed for a limited range of sensor error and disturbance environment 
and considered a least-squares based FDI algorithm. The threshold 
compensation for separation effects offered in references 4 and 6, 
furthermore could lead to high false alarm rate and consequently to system 
failure. An alternative approach to threshold compensation for separation 
effects and hence to reliable dual fail-operational capability in the 
context of a vector-based FDI algorithm is offered in this paper. 

This paper presents a description of the RSDIMU, an overview of the 
multi-level FDI concept, inertial sensor error models, and development of 
the vector-based FDI algorithm. The FDI capability of the algorithm is 
evaluated with the use of a digital simulation of a commercial transport 
over a range of turbulent environments. 
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resolution of accelerometer output in body coordinates, 

B = x,y,z; i = 1,2, 3, 4, (ft/s) 

direction cosine matrix element, (i=l,2,3), rad 
computation time interval, s 

edge vector relating ith to jth instruments, j>i; i = 1,2,3 

2 

vector of vehicle body axes gravitational forces, ft/s 
location parameter matrix, rad 

2 

acceleration due to gravity, (ft/s) 

distance from vehicle eg to sensor location, ft 

logical variable for isolation of failed sensor 

sensor output, rad, ft/s 
number of sensors 

edge vector parity equation residual relating ith and jth 
accelerometers, k = h, or s for hard-, or soft-range, ft/s 

edge vector parity residual relating ith and jth gyros, k = 
h, m, or s for hard-, medium-, or soft-range, rad 

accelerometer measurement output, i = 1,2, 3,4; k = x,y;ft/s 

gyro measurement output, i = 1,2, 3, 4; k = x,y; rad 

spin or pendulous axes of inertial sensor; i = 1,2, 3, 4 
time, s 

failure detection threshold, rad, or ft/s 
g sensitive bias, i = 1,2, 3, 4; rad/s/g 

2 

differential separation effect, i = x,y,z, (ft/s ) 
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k = x,y; i = 1,2, 3,4; ft/s 


8s accelerometer error, 

a. . 
ki 

8s gyro error, k = x,y; i = 1,2, 3, 4; rad 

g ki 


Ss maximum or upper bound of accelerometer error, ft/s 

a m 

e scale factor error, ppm 
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Subscripts 

a 

f 

g 

eg 

i, j> k 

la 
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Superscripts 


2 

bias error, rad/sec or ft/s 
misalignment error, rad 
body axes angular rates, rad/s 


accelerometer 
filtered value 
gyro 

center of gravity 

element number, row, or column of matrices 
lever-arm 

maximum or upper bound 
spin/pendulous axes 


B 

T 

-1 


body-axes components 
transpose 

least-squares estimate 
inverse 


DESCRIPTION OF THE RSDIMU 

The RSDIMU has a complement of four TDOF gyros and four TDOF 
accelerometers mounted in a semi-octahedral configuration (see fig. 1) such 
that dual fail-operational performance is possible (ref. 2). The spin-axes 
of the TDOF gyros and pendulous axes of the TDOF accelerometers, Sj, are 

normal to the faces of the semi -octahedron. The measurement axes of the 
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accelerometers, s , s , lie in the plane of the face and are oriented 
a xk a yk 

such that the bisector of the sensitive axes is perpendicular to the 
baseline of the semi-octahedron. The gyro and accelerometer sensitive axes 
are nominally collinear. Any two gyros or two accelerometers would 
constitute sufficient information to complete an orthogonal triad for 
angular rate or linear acceleration body frame solutions. The reference 
frame for the sensors shown in figure 1 is x (pitch), y (roll), and z (yaw); 
this constitutes the ENU reference frame commonly used in navigation. From 
figure 1 the coordinate transformation which relates the sensor measurement 
axes to the body axes is 


H 



( 1 ) 


where cl = (/3 + l)/2/J, c2 = (/T - l)/2/3, and c3 = 1//3. The first two 
rows of this 8x3 matrix represents the direction cosines for sensor axes 
xl and yl; from rows 3 and 4 the output of sensor 2 can be found, etc. The 
dashed line in the matrix H indicates the separation of the RSDIMU into 
halves: IMU1 (instruments 1 and 2) and IMU2 (instruments 3 and 4). In the 
ideal case the gyro and accelerometer direction cosines are the same. The 
4x3 matrix H g defines the ideal transformation from the gyro/accelerometer 

spin/pendulous axes (s^, S2> s,j, s^) to the body frame (x,y,z) as 
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( 2 ) 


As shown in figure 2, the sensor data output of the RSDIMU is processed 
in four separate channels. The output of each sensor pair is compensated 
for errors using a micro-processor. The compensated data is then processed 
in four separate solutions. Each channel processes FDI and redundancy 
management (RM) algorithms to satisfy the dual fail-operational requirement 
on the system. This is followed by least-squares solutions of the outputs 
of two valid gyros and accelerometers in body axes, after which conventional 
algorithms for attitude, alignment, and navigation are processed. A least- 
squares solution for linear acceleration can be obtained from any two (or 
more) accelerometers from the expression 


* T - 1 T 
a = (H H) H m a /Dt 


(3) 
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where m is the 4x1 sensor measurement vector formed from the two 
a 

accelerometers used for the solution, and H is the 4x3 direction cosine 
matrix, obtained from equation (1), relating the sensor axes to the body 
frame for the same two accelerometers. The least-squares estimates are 
formed from two sensors in each of the channels (e.g. channel one uses 
sensors 1 and 2). If an accelerometer or gyro fails, the ordering of 
solution pairs in that channel is changed via the redundancy management 
algorithm. 


FAILURE DETECTION AND ISOLATION CONCEPT 

The role of fault tolerant algorithms to meet avionics systems' 
reliability and performance is illustrated in figure 3. The information 
from the skewed array of inertial sensors is first proved reliable before 
being passed to the flight control, display, or navigation algorithms. 

Since the sensors are skewed relative to the aircraft principal axes, FDI 
must be accomplished as a function of the sensor axes. 

The purpose of the experimental RSDIMU is to provide a basis for the 
evaluation of FDI algorithms which provide the dual fail-operational 
capability necessary to satisfy reliability and performance requirements. 

To satisfy dual fail-operational requirements, the RSDIMU must be able to 
survive two accelerometer or gyro failures and cease operation after a third 
malfunction of either type of sensor is detected. Failure detection is 
accomplished with the use of parity equations which are linear combinations 
of the sensor outputs and which are compared to a failure threshold. The 
parity equations remove the quantities the sensors measure; thus they leave 
residuals which are composed of undesirable quantities. The parity equation 
residuals, therefore, are a function of the instrument uncompensated errors, 
noise, and quantization. If the sensors are physically separated, 
differences in sensed structural modes, vibration, and lever-arm 
acceleration would impact the parity residuals. Static and dynamic sensor 
errors and separation effects, which are normal (but undesirable) sensor 
outputs, would dictate the level of detectable failure unless properly 
compensated, since the detection of failures is accomplished by comparison 
of a function of the parity residuals to a threshold. Therefore, the 
generation of thresholds for both gyros and accelerometers, which compensate 
for dynamic sensor errors and separation effects, is a major consideration 
in FDI algorithm development. 

For flight control purposes the failure detection process is simple; 
the parity residuals are merely compared to a constant level threshold. For 
the avionics functions which require greater accuracy, however, the process 
is more complicated. Figure 4 illustrates the flow of information 
applicable to the display and navigation FDI processes. The parity 
equations are formed from current sensor data, filtered and compared to a 
threshold. The threshold is formed from several contributions: 1) a 
constant to account for unattenuated noise and quantization levels in the 
residuals; 2) known sensor error statistics which can be estimated 
analytically, such as misalignment, scale factor, and biases; 3) a function 
of the parity residuals passed through a washout filter; and 4) undesirable 
low frequency residuals, such as lever-arm acceleration. Immediate past 
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values of sensor data are used to form the threshold function to preclude 
corruption caused by hard-failed sensors. 

Since the FDI algorithm must be designed to cover sensor failures which 
affect flight control, display, and navigation functions, a baseline 
configuration to allow multi-level coverage has been established (ref. 3) as 
shown in figure 5. Unfiltered parity equations are processed at the sensor 
measurement rate (64 Hz) and compared to an uncompensated threshold to 
ensure the removal of hard-failed sensor data before vehicle controllability 
is affected. The same parity residuals are filtered to attenuate noise so 
that moderate- or soft-level failures which might affect display or 
navigation performance might be easily detected. Moderate-level failures 
are removed from the system quickly since a first-order lag with fast rise 
time is used to filter the residuals. A second-order filter or long time 
constant first-order filter is used in the soft-failure channel to enhance 
the detection of failures which affect the navigation function. The 
processing rates for these channels, 32 Hz, and 1 Hz, reflect the fact that 
mid- and soft-range failures can be tolerated for a longer period of time 
without serious effect on display or navigation performance; however, these 
rates and the filter time constants are design parameters. 


INERTIAL SENSOR ERROR MODELS 

The angular rate sensors used in the RSDIMU are TDOF dynamically tuned 
gyros (ref. 2). The first-order performance parameters, consistent with a 
moderate to low accuracy inertial navigation system (INS), are given in 
table I. The first-order uncompensated errors for the gyro include: g- and 
non-g sensitive biases, misalignment, and scale factor nonlinearities. An 
expression for the output of the x-axis of gyro 1 (not including the effects 
of quantization and noise) is 


s = f-cl-to + c2*w - c3 •« 1 * Dt + 6s 
g xl X y z g xl 

= f-cl-q + c2*p - c3*r + X - u *cl*q + y *c2*p - y *c3*r 

g l g ll g 12 g 13 



(-cl*a x + c2‘ay - c3*a z )/g 


+ e ’(-cl'q + c2*p 
g l 


-c3*r)] *Dt 


(A) 


where the Dt factor accounts for the gyro output (radians/cycle). The first 
three terms of equation (4) represent the output of a perfect gyro, and the 
remaining terms represent sensor error as indicated in table I. The input 
rates to the gyros include inertial rates and local disturbances. 


Linear acceleration is measured by TDOF accelerometers. The 
performance parameters given in table I are consistent with the requirements 
of a moderate to low accuracy INS. An expression for the output of the x- 
axis of accelerometer 1 is 
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The first three terms of equation (5) represent the output of an ideal 
accelerometer, and the remaining terms represent uncompensated first-order 
errors of the type listed in table I. 


POSITION DEPENDENT DYNAMICS 

Because of vehicle safety considerations, it may be necessary to 
separate the RSDIMU sensors in halves to decrease the probability of loss of 
the entire RSDIMU in the event of damage (e.g. caused by fire, lightning, 
etc.) to the aircraft. This means that different levels of vibration, 
structural modes, and lever-arm accelerations will be experienced by the 
sensors. Unless properly compensated in the FDI process, these effects 
could reduce failure detection sensitivity particularly in the soft-range 
failure channel which affects navigation performance. The rigid body 
acceleration in terms of accelerometer location relative to the vehicle 
center of gravity (eg) is 


a = v + coxv-F + wxl + wx<oxl 
g 

The first three terms on the right side of this expression represent the 
acceleration at the vehicle eg, and the last two terms on represent lever- 
arm acceleration. Expansion of this equation yields 
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An expression for the difference of the position effects between IMU1 
and IMU2 is given by 

a - a = &a 
x 2 Xj X 

= 

la2 x lal 


a y 2 " a y x = S 


6a - 6a 
y la2 y lal 


% * \ 


Z la2 z lal 


(7) 


The vehicle linear acceleration measured at the IMU1 and IMU2 locations 
by accelerometers 1 and 2, and accelerometers 3 and 4, respectively, may be 
obtained from equation (3); therefore, these solutions when differenced 
provide a measure of the separation effects between the IMU halves as 
indicated by equation (7). The method could be easily extended to include 
structural modes and vibration for both the gyros and the accelerometers 
(refs. 4,6). 


VECTOR BASED FDI METHOD 
Parity Equations 

A technique to determine parity equations which are particularly suited 
to TDOF instruments has been developed (refs. 1,7). A set of six parity 
equations for the gyros or accelerometers of the RSDIMU is formed when pairs 
of instruments are compared along an edge of the semi-octahedron. An 
expression for the edge vectors is formed from the cross products of the 
sensor spin-axes as illustrated in figure 1 and using equation (2) 

e ij = (s i x s j l s i x s jl> J >i 5 1 = M,3 

( 8 ) 

The accelerometer parity equations for the vector-based method are defined 
as the dot product 

P a.. = l(a i " a j)' e ijl‘ Dt j>iJ i = 1,2,3 

(9) 
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B B 

where and a^ are the outputs of the ith and jth accelerometers expressed 
in body axes. When expanded, this expression becomes 
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= l//2*(a* - a* + a* - a*)*Dt 


P a ■ l//2*(a* - a* + a^ - a 3 )*Dt 
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p a u = 1//J * (a l - a 4 + a l " a 4 ),Dt 


P = l//2-(a£ - a y 3 + a* - a^’Dt 


P a = 1/ ^2‘ (&2 ~ a 4 + a 2 " a ^) * Dt 


p a 34 " X// 2'< a 3 - a 4 + a 4 - a 3>' Dt 


( 10 ) 


To express the quantity aj in terms of sensor output, use equation (1) to 
obtain 


a® = [H T -s ]/Dt 
1 a ki 


k = x,y; i = 1,2, 3, 4 


T 

where H is the 3x2 matrix corresponding to the ith accelerometer as given 
by equation (1). This expression can be used to obtain the parity equations 
in terms of sensor measurements. To get the parity residuals in terms of 
sensor errors and separation effects, substitute equation (5) for the sensor 
measurements taking care to account for sensor location (see the appendix 
for details). The results are 
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p o = 0.966* ( 6s - 6s ) + 0. 259* ( 8s - 8s ) 

23 a x2 a y3 a y2 a x3 

+ 0.7071* I (Sa - 8a ] • Dt 
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(ID 

where the Ss (k = x,y; i = 1,2, 3, 4) terms represent total accelerometer 
a ki 

error. The separation effect terms, 8a., appear in the parity equations 

which have physically separated sensors, p and p do not contain 

a 12 a 34 

separation effect terms since these parity equations contain colocated 
sensors only (see fig. 1). When these parity residuals are compared to a 
failure threshold to determine if a failure has occurred, the effects of 
sensor location must be compensated to increase the sensitivity of the 
failure detection process within acceptable limits. 

The development of gyro parity equations and the reduction to sensor 
errors and separation effects are similar to the accelerometer development. 
Since the gyros have a larger dynamic range than the accelerometers, 
however, the compensation of sensor errors and separation effects takes on 
more importance. 


DYNAMIC THRESHOLD GENERATION 

Sensor failure detection is determined from a comparison of the parity 
residuals to a threshold. If the threshold is exceeded, a failure is 
declared. For the hard-range failures the threshold may be merely a 
constant. For the mid- and soft-range levels, however, normal dynamic 
sensor errors and separation effects, which are most pronounced in 
maneuvers, are larger than sustainable bias errors. For example, during a 
standard rate turn (3 deg/sec), a gyro scale factor error of 100 ppm yields 
an equivalent drift rate of 1 deg/hr. A bias level this high would result 
in serious navigation error. 

As suggested by equation (5) and table I, the accelerometer outputs 
contain static (bias) and dynamic (misalignment and scale factor 
nonlinearity) errors. Since these errors are statistically known (e.g. from 
manufacturer's data), an estimate for the maximum first-order accelerometer 
errors can be written from equation (5) as 

5s a = lX a + (e a + M a ) *<l cl * a x I + l cl * a v I + l c3 * a z Dl* Dt 
m m m m f y f f 

( 12 ) 
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where the maximum sensor error terms are determined from table I and 

equation (1), and the a. terms are least-squares estimates for 

f 

accelerations from an appropriate accelerometer pair; also, these terms are 
filtered to be compatible with the avionics channel under consideration 
(mid-, or soft-range). An estimate for the maximum accelerometer sensor 
error contribution to a parity equation is obtained from the coefficients of 
the dynamic sensor error terms in equation (11) as 

p = 2.828*Ss 
a a 

m m 

(13) 

The constant in equation (13) is the sum of the absolute values of the 
coefficients of the sensor error terms in parity equations p , and p in 

a 13 a 24 

equation (12) to account for worst case conditions. The sum of the absolute 
values of the coefficients in the remaining parity equations is 2.445. 


Equation (13) constitutes the compensation for dynamic sensor error to 
the threshold for failure detection; however, it does not take into account 
the effects of quantization and sensor noise. The quantization errors in 
the parity residuals result from the digitization of the sensor torquing 
loop output for each sensor; the digital pulse weight for the accelerometers 


_3 

is 10 g at the 64 Hz processing rate. A constant term 


T , 
aq’ 


is added to 


the threshold, therefore, to account for unattenuated quantization and 
noise. This term constitutes the threshold for the flight control channel. 
The noise and quantization compensation terms in the filtered channels are 
determined by the unattenuated residuals. 


Two methods have been implemented to provide compensation in the 
accelerometer thresholds for the separation effects indicated in equation 
(11) (refs. 4-6). The separation effect terms derived for equation (7) may 
be obtained from the least-squares solutions of the accelerometer 
measurements. From equation (3), the estimates for body axis accelerations 
for IMU1 (accelerometers 1 and 2) are 
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and similarly for IMU2, 
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a = (0. 1585*(s - s ) + 0.5915*(s - s ))/Dt 

y 34 a y4 a x3 a y3 a x4 


a = (-0. 183*(s + s ) - 0. 683*(s + s ))/Dt 

z 34 a x3 a y4 a y3 a x4 

(15) 

These least-squares estimates for acceleration may be used to provide exact 
compensation for the separation effect terms which appear in the parity 
residuals given in equation (11). The threshold expressions for each parity 
equation are, 
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where the separation effect terms are appropriately filtered. It is easily 
seen, however, that false alarms are possible with this method of 
compensation. That is, a failure in sensor 3 would affect the threshold 
term for sensors 1 and 4, etc. To correct this deficiency, the method of 
threshold compensation illustrated in figure 4 was developed. 

The parity residuals contain undesirable high frequency terms (compared 
to vehicle dynamics), which include differential vibration and structural 
modes, and high frequency electronic noise spikes. Passing the parity 
residuals through a high pass filter drives low frequency terms, such as 
lever-arm acceleration and biases toward zero, while compensating the 
threshold for the high frequency effects which appear in the residuals. 

This threshold compensation, which is used only in the mid- and soft-range 
channels tends to render the failure detection process false-alarm free. 

High frequency lever-arm acceleration effects are compensated in the 
threshold. The compensation for low frequency components of lever-arm 
acceleration, however, must be determined separately. 

As illustrated in figure 4, the low frequency components of lever-arm 
acceleration are computed in real time and added directly to each threshold. 
The required differential separation effects may be computed directly from 
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I 


equations (6), (7), and (11), and added to equation (16). In p , for 

a 13 

example, the low frequency part of (6a - 6a ) can be formed and added to 

x y 

the total threshold for that parity equation. 


la 


= (6a - 6a ) 

' V IT ' 


T a la " I' <“y + \l ) * ( "y'“x ' «z>‘ (1 y2 ~ V’ 


+ <“y + *x»z>-< 1 ,2- l zl )1-Dt - l( “z * “x'“y)- (1 x2 “ W 


<\ * “z>-<V - V + <V“y “ “x ),(1 z2 - 1 zl> l ’ Dt 


(17) 


This expression is computed directly from gyro measurements converted to 
body angular rates through least-squares solutions. The angular 
accelerations are obtained by back differencing the angular rate solutions. 
Each rate is filtered to be consistent with accelerometer FDI. The absolute 
value of this expression is added to the threshold. 


To summarize, the threshold terms for the vector-based method of 
accelerometer FDI consist of: 1) a constant to account for quantization and 
noise; 2) compensation for statistically known terms such as scale factor 
and misalignment uncompensated errors; 3) a high pass filter to include high 
frequency residuals in the threshold; and 4) low frequency compensation for 
lever-arm acceleration. 


The gyro threshold function is determined in the same manner as the 
accelerometer threshold function, except that there is no low frequency 
compensation to be determined separately (e.g. lever-arm acceleration). 


Failure Isolation 


Each parity equation is tested against its corresponding threshold, so 
that, if ( | p | — | T |) > 0, the parity equation indicates a failure; a 

3 . . . 3 • • 

ij ij 


logical flag, , is set true for this event. 


At the completion of all six 


threshold tests for the parity equations a set of logical equations is 
examined to isolate a failed instrument. The logical equations are, 


A 1 = L 12* L 13 + L 12* L 14 + L 13* L 14 
A 2 = L 12* L 23 + L 23 L 24 + L 12* L 24 
A 3 = L 13* L 23 + L 13* L 34 + L 23* L 34 
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A 4 " L 14* L 24 + L 14' L 34 + L 24' L 34 


( 18 ) 


where • denotes logical "and" function and + denotes logical "or" function. 
If sensor 1 fails, ^ 13 * and will be set true when the parity 

residuals fail their respective threshold tests. According to equation 
(18), will be set true (e.g. isolated as failed) when any two flags 

relative to the same sensor are set true. When A^ is set true, redundancy 

management removes the entire sensor from further processing even if only 
one measurement axis fails. 


To isolate a second failure only three tests are available. For 

= L 23* L 24 
= L 23* L 34 
= L 24 L 34 

(19) 

this expression isolates a second failure after sensor 1 has failed. A third 
failure may be detected but not isolated. 


example, if sensor 1 has failed, 


Equations (18) and (19) are applicable to multiple nonconcurrent 
failures for the gyros or accelerometers. Modifications in the isolation 
logic are easily implemented to account for the possibility of multiple 
concurrent failures. 


Failure Coverage 

A characteristic of TDOF instruments is that a failure may be reflected 
in either of its measurement axes,* also, if a failure occurs in one of the 
sensitive axes, the second axis is likely to follow. Thus, a failure, which 
is detected and isolated, results in removal of both axes of the sensor as 
the logic of equations (18) and (19) indicate. 

Because the sensor clusters for the accelerometers and the gyros are 
symmetric, the first failure is uniformly detectable. That is, if the 
measurement axes of the instruments were extended in space, the axes would 
lie uniformly on the surface of a cone; this can also be determined from 
table II and equations (10) and (11). The first failure for any of the 
sensors is equally likely to be detected since the parity equation 
coefficient terms are the same for each sensor axis in the system of 
equations as given in table II. Once the first failure has been detected 
and isolated, however, an unsymmetric array of sensors remains. Failures 
are not equally likely to be detected. From table II it can be seen that it 
is possible to require a failure level to be 1/0.2588 times the threshold 
level to detect a failure depending on the sensor under consideration. 
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It is clear in the system of parity equations of equation (11) that 
there are sensor failures for which the parity equations are transparent. 

If both axes of accelerometer 1 open (e.g. null output) simultaneously, p 

a 13 

would be transparent to the failure; however, p , and p would readily 

a 12 a 14 

detect the open. On the first failure level, therefore, the accelerometer 
null would be immediately detected and isolated. On the second failure 
level, however, the null failure detection and isolation would be delayed, 
because of the transparency in p (or p ) until vehicle dynamics 

a 13 a 24 

increase the parity residuals to allow failure detection. The same comments 
apply to third level failure detection if opposite sensors remain after two 
failures. An analysis of these singularities is given in reference 8. 


DESCRIPTION OF SIMULATION 

The vector-based failure detection and isolation algorithm for the 
RSDIMU under consideration was tested with the use of a digital simulation 
of a commercial transport vehicle (ref. 9). The aircraft is modeled in six 
degrees of freedom with nonlinear aerodynamics. A flight control system and 
turbulence is included in the simulation; however, structural modes and 
vibration have not been included in the vehicle modeling. The skewed gyro 
and accelerometer arrays are modeled 22 ft. forward of the aircraft eg and 
separated 4 ft. in both the x and z directions so that the effects of lever- 
arm acceleration may be assessed. The sensor data is determined from the 
aircraft equations of motion and input to the FDI algorithms for gyros and 
accelerometers. 

Figure 6 shows the ground track profile used to evaluate the fault 
tolerant algorithm during the dynamic phases of the vehicle flight. The 
profile includes features from a commercial transport flying into a 
microwave landing system environment. The aircraft performs two left turns 
and four right turns at a constant altitude of 6700 feet at 150 knots 
before descending at 3000 seconds to 1000 feet to perform a runway alignment 
maneuver. The aircraft speed at final approach to landing is 130 knots. 

The aircraft performs decrab and flare maneuvers just before the landing, 
which occurs at 3409 seconds. The aircraft linear accelerations and 
angular rates are shown in figures 7 and 8, respectively, to show the 
magnitude of these quantities as well as to show the accuracy of the RSDIMU 
least-squares solutions. For the case shown the nominal gust intensity is 6 
ft/sec; the wind has a steady state velocity of 10 ft/sec at an angle of 
20/. The wind components are shown in figure 9. The three gust conditions 
considered for this study were 2 ft/sec (light turbulence), 6 ft/sec 
(moderate turbulence), and 21 ft/sec (extreme turbulence). The ability of 
the vector-based FDI algorithm to detect failures under turbulent conditions 
is critical. 

The plotting points for the figures were saved at 1-second intervals. 
For this paper only one complete FDI channel for the RSDIMU was implemented. 
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DISCUSSION OF RESULTS 


This section discusses the results obtained with the simulation just 
described for the vector-based FDI algorithm. The time histories of the 
parity residuals and failure detection thresholds are presented using the 
equations developed in this report. The parity residuals for the gyros and 
accelerometers, and their respective thresholds are plotted in deg/hr, and 
g's, respectively. 

Figure 10 shows the gyro parity equation residuals obtained, using the 
equivalent of equation (11) for gyros, for the flight described in figures 
6-9. The absolute value of each parity equation residual is shown, since it 
is this quantity which is measured against a threshold for failure 
detection. The unfiltered residuals are random in nature because of sensor 
quantization; also, the effects of maneuvers in the last half of the flight 
are barely evident. The quantization pulses evident in residuals p , and 

g 13h 

p are the result of the symmetry in the parity equation coefficients. 
g 24h 

The peak value of the residuals is about 196 deg/hr. The mid-range parity 
equation residuals are passed through a first-order low-pass filter with 
time constant of 10 seconds. The effects of dynamics are plainly evident 
after the unaccelerated portion of the flight. The peak value in P is 

g 24m 

2.43 deg/hr. The soft-range parity residuals are passed through a first- 
order low-pass filter with time constant of 30 seconds. The peak residual 
during the landing maneuver is 1.47 deg/hr. 

From figure 10 it is apparent that the effects of vehicle maneuvers 
warrants the use of dynamic failure detection thresholds. If a constant 
threshold were used it would have to be large enough to accommodate all the 
possible maneuvers the aircraft would experience. This would compromise the 
ability of the system to detect failures during unaccelerated portions of 
the flight, and hence the performance of the navigation outputs. Therefore, 
the use of dynamic thresholds which are sensitive to dynamics is justified. 

Figure 11 shows the hard- and soft-range accelerometer parity residuals 
for the same flight. As in the case of the gyro parity residuals, the 
absolute values are shown. The hard-failure channel residual is random in 
nature because of quantization and is relatively unaffected by vehicle 
maneuvers. The soft-accelerometer channel residuals appear to be relatively 
unaffected during this flight; however, this is caused in part by the high 
noise level created by the turbulent environment. The low-pass filter time 
constant for the soft channel residual is 5 seconds. The peak values for 

3 a 

the hard- and soft-range parity residuals are 4.44 x 10~ g and 2.56 x 10~ 
g, respectively. The quantization effects apparent in the residuals for 
p , and p , are the result of the symmetry in the parity equation 
a 13h a 24h 

coefficients. Because of the limited dynamic range of the accelerometers 
there was no mid-range accelerometer FDI channel implemented for this paper. 

The threshold levels obtained for the vector-based FDI algorithm are 
given in table III. The values used for uncompensated errors are given in 
table I. Since equation (13) represents a worst case situation for 
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threshold generation, 2-a values were used for the uncompensated errors 
given in table I. This renders a minimum detectable first failure for the 

_3 

soft gyro channel of 0.19 deg/hr and 1.5 x 10 g for the soft accelerometer 
channel. The mid-range gyro threshold constant, and the hard-range gyro and 
accelerometer channels are design values and are arbitrarily set for this 
paper. The gyro and accelerometer low frequency dynamic threshold functions 
as given by equation (17), exclusive of the separation effect terms, are 
shown in figure 12. These thresholds clearly indicate the need for dynamic 
threshold compensation during the maneuvering portion of the flight. They 
also indicate the failure sensitivity during the constant portion of the 
flight and the importance of maintaining minimum time constants in the soft- 
and mid-range failure detection channels to maintain that sensitivity. The 
dynamic threshold in the case of the soft gyro channel is more than an order 
of magnitude greater during maneuvers than in constant and level flight. 

The normal scale factor and misalignment error at 3 deg/s is 3.4 deg/hr. 

The dynamic portion of the threshold given in figure 12 compensates for 
low frequency dynamic errors. Unattenuated high frequency noise is 
compensated through the washout filter as shown in figure 4 while constant 
biases and low frequency terms are driven toward zero. The effects of these 
terms are given in figure 13 for the soft gyro channel. The time constant 
for the washout filter is a design parameter and is set to 150 seconds for 
this paper. 

As indicated in figure 5, each set of parity residuals for the gyro and 
accelerometer channels (soft-, mid-, and hard-) are subjected to threshold 
tests to determine if a failure has occurred. The results of the threshold 
test for the soft gyro and accelerometer channels is given in figures 14 and 
15. A positive result for the threshold test would indicate a failure 
detection. The sensitivity for failure detection is greatest during the 
unaccelerated portion of the flight as indicated in both figures. The 
results of the threshold test are always well behaved; therefore, this 
indicates the propensity toward false alarms is low. The effects of 
maneuvers is to drive the results of the test more negative; this is 
reasonable since the sensor errors are greatest during maneuvers. 

Sensor failures were introduced into the simulated aircraft system to 
test the FDI capability of the vector-based algorithm. The injected 
failures were intended to cover the spectrum of failures for all the 
channels of operation. The failures were repeated for three levels of wind 
disturbance, light, moderate, and extreme. The results are listed in table 
IV. The first two flights covered the ground track given in figure 6. In 
each of these flights three failures were inserted in the gyro signals at 
the times indicated in the table. In the first flight the 25 deg/hr failure 
was detected in a timely fashion for all the turbulence environments. The 
open failure took six cycles to detect in light turbulence; two cycles in 
moderate turbulence; and it was detected on cycle in the extreme turbulence 
case. The hard failure was detected on cycle in all three environments. 

The accelerometer failures for the first flight included a soft first 
failure and a null second failure. The first failure was detected in a 
timely fashion in the soft channel, but the null failure took 20, 34, and 8 
seconds to detect for the light, medium, and extreme levels of turbulence, 
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respectively. This delay is caused by the transparency in parity equation 
p to null type failures as previously discussed. 
a 24 


For the second flight, two soft failures were injected in the gyro and 
accelerometer signals and a third hard failure was added to the gyro. The 
soft gyro failures were not detected in the extreme turbulence environment. 
The gyro hard failure was detected on cycle. The accelerometer failures 
were detected in a timely fashion. 

The third and fourth flights included only the final 1800 seconds of 
the flight path given in figure 6. As indicated in table IV, three soft- 
level failures were added to the gyros and two soft failures were added to 
the accelerometer signals in flight 3. All failures were detected in a 
timely fashion. 

Three failures were added to the accelerometer signals and two failures 
to the gyro signals for the fourth flight. Both axes of gyro 1 and 
accelerometer 1 were failed open at 300 seconds; both failures were detected 
on cycle. A second soft level failure was added to the gyro and 
accelerometer axes x2 at 600 seconds. The accelerometer failure was 
detected and correctly isolated in approximately 90 seconds under all 
turbulence environments. The gyro failure was only detected and isolated in 
the light wind turbulence environment. 

CONCLUDING REMARKS 

A vector based failure detection and isolation algorithm has been 
developed for a dual fail-operational, separated, and communicating 
redundant strapdown inertial measurement unit. The performance of the 
algorithm has been demonstrated via simulation for a broad spectrum of 
failures in light, moderate, and extreme turbulence environments. The 
development of failure detection thresholds which are sensitive to low and 
high frequency disturbances was a major consideration in the development of 
the algorithm. It is clear that turbulence affects the FDI algorithm 
capability to detect navigation level gyro failures, while the accelerometer 
FDI is minimally affected. The gyro and accelerometer FDI functioned 
without false alarm or incorrect isolation of failure under the conditions 
presented. 
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APPENDIX 


DERIVATION OF PARITY EQUATIONS IN TERMS 
OF SENSOR ERRORS AND SEPARATION EFFECTS 


The derivation for p in terms of sensor errors and separation 

a 14 

effects is shown as a representative case. Starting with the expression for 
p from equation (10), 
a 14 


p = l//2*(a^ - a]f + a, - a?)*Dt 
a 14 1 4 1 4 


the expression for a? is obtained from equation (1). 


(Al) 




>4 


z 

l l 


z 

l 4 


c2*s 

- cl*s 

a xl 

3 « 

yi 

cl’S 

+ c2*s 

a x4 

a , 
y4 

c3*s 

- c3*s 

a xl 

a 1 

yi 

c3*s 

- c3*s 

a x4 

a * 
y4 


(A2) 


Parity equation p becomes in terms of sensor measurements, 
a 14 


p = 1/vT* ((c2-c3)*s - (c2-c3)*s + (c3+cl)-s - (c3+cl)* s 

a 14 a xl a y4 a x4 a yl 


= 0.966 *(s - s ) + 0.2588*(s - s ) 

a. a, a, a, 

x4 yl y4 xl 

(A3) 

Next, substitute for the sensor measurements using equation 5, taking care 
to identify the location of the sensors. The expression is 
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p = 0.966(5s - Ss ) + 0.2588(6s - Ss ) + [0.966(-c2-a 9 

a 14 a x4 a yl a y4 a xl xz 

- cl>a y2 " c3 ' a z2 " c2 ‘ a xl + cl ’ a yl + c3 ' a zl> + * 25 88(cl-a x2 

+c2 * a y 2 - c3-a z2 + c2-a xl - c2-a yl + c3-a #1 >]-Dt 

(A4) 


where a „ and a . represents the x-axis acceleration at locations IMU2, 
x2 xl 

and IMU1, respectively. 


14 


= 0.966(8s - Ss ) + 0.2588(Ss - 8s a ) + 0.7071(3. - a „ 

a „/. a ,.i a ,,/. a x i y 1 


x4 


yi 


y4 


+ a zl - a z2 ) -° t 


<A5) 


From equation (7) this simplifies to 

p = 0.966(Ss - 8s ) + 0.2588(Ss - Ss a ) 

a 14 a x4 a yl a y4 a xl 

- 0. 7071( 8a + 8a )-Dt 
z y 

(A6) 


which is the same as equation (11). 
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TABLE I.- TWO DEGREE-OF-FREEDOM GYRO AND ACCELEROMETER PARAMETERS 


Error Coefficients 

Units 

One Sigma Values 

Accelerometer fixed bias 

g 

O 

1 

Accelerometer misalignment 

arc sec 

12 

Accelerometer scale factor 

error ppm 

100 

Accelerometer random noise 

ft/sec 3/2 

0.0025 

Accelerometer scale factor 

ft/sec/pulse 

5 x 10" 4 

Gyro non-g sensitive bias 

deg/hr 

0.015 

Gyro g-sensitive bias 

deg/hr/g 

0.015 

Gyro misalignment 

arc sec 

12 

Gyro scale factor error 

ppm 

100 

Gyro scale factor 

arc sec/pulse 

0.635 

Gyro random noise 

deg/ /hr 

0.002-0.01 
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TABLE II.- FAILURE DETECTION SENSITIVITY FOR VECTOR-BASED ALGORITHM 


Sensor 

p 

a 12 

P 

a 13 

Parity Equation Residual 
P P 

a 14 a 23 

P 

a 24 

P 

a 34 

s 

0.96593 

0.70711 

-0.25882 




a- 

lx 







s 

0.25882 

-0.70711 

-0.96593 




a i 

iy 







S 

-0.25882 



0.96593 

0.70711 


a 2x 







s 

-0.96593 



0.25882 

-0.70711 


a 2y 







s 


0.70711 


-0.25882 


0.96593 

a~ 

3x 







s 


-0.70711 


-0.96593 


0.25882 

3y 







s 



0.96593 


0.70711 

-0.25882 

a 4x 







s 



0.25882 


-0.70711 

-0.96593 

a y4 
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TABLE III.- GYRO AND ACCELEROMETER CONSTANT THRESHOLD FACTORS 


Sensor 

Channel 

Threshold 

Gyro 

Hard 

1795 deg/hr 


Mid 

4 deg/hr 


Soft 

0 deg/hr 

Accelerometer 

Hard 

0.298 g 


Soft 

9 _& 
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TABLE IV.- FAILURE DETECTION AND ISOLATION CAPABILITY FOR VECTOR-BASED 
ALGORITHM 


Fit. 

Failure 

Sensor 

Insertion 

Isolation Channel 

No. 

Magnitude 

Axis 

Time (s) 

Time (s) 



Failed 


Turbulence Environment 





Light Moderate Extreme 


Gyro Failures 

1 



25 Vhr 

xl 

900 

1.28125 

1.625 

3.34375 

mid 


open 

x2,y2 

2100 

0.09375 

0.03125 

0.0 

mid 

2 

3600 °/hr 

x3 

3400 

0.0 

0.0 

0.0 

hard 


0.2 Vhr 

xl 

600 

262 

262 

, * 
n.d. 

soft 


-0.85 Vhr 

x2 

2100 

21 

21 

n.d. 

soft 

o 

1800 Vhr 

x3 

3400 

0.0 

0.0 

0.0 

hard 

J 

-0.85 Vhr 

x2 

300 

81 

80 

83 

soft 


-0.85 Vhr 

yi 

600 

154 

152 

154 

soft 


0.85 Vhr 

x3 

900 

110 

111 

124 

soft 

4 

open 

xl,yl 

300 

0.03125 

0.0 

0.0 

hard 


0.25 Vhr 

x2 

600 

882 

n.d. 

n.d. 

soft 

Accelerometer Failures 

i 

1.5x10 3 g 

xl 

900 

182 

186 

213 

soft 

2 

open 

x2,y2 

2100 

20 

34 

8 

soft 


2xl0~ 3 g 

xl 

1200 

100 

102 

121 

soft 

3 

2xl0 _3 g 

x2 

2700 

213 

215 

201 

soft 


2xl0" 3 g 

xl 

300 

104 

103 

113 

soft 


2xl0" 3 g 

x2 

600 

200 

201 

208 

soft 

4 

open 

xl,yl 

300 

0.0 

0.0 

0.0 

hard 


3x10 3 g 

x2 

600 

90 

91 

90 

soft 


2.0 g 

x3,y3 

2100 

0.0 

0.0 

0.0 

hard 


* n.d. not detected 
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28 


Figure 2. Redundant strapdown inertial measurement unit software data 
flow. 
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Figure 3. Fault tolerant integrated avionics perspective. 






aration effects 
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Figure 4. Failure detection and threshold compensation process. 














Sensor data 



1 Hz 


Figure 5. Multi-level structure and FDI processing flow. 
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Aircraft body axis RSDIMU Least-squares 

accelerations, g acceleration estimates 



100 780 1460 2140 2820 3500 

Time, sec 


Figure 7. Aircraft accelerations and corresponding IMU least-squares 
solutions. 
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Linear velocity gust Angular velocity gust 

environment ft/sec environment, deg/sec 


3.88 




100 780 1460 2140 2820 3500 

Time, sec 


20.47 

O 
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i— 

o 

-17.90 

17.85 

o 

a> 

*-> 

o 

-16.04 



100 780 1460 2140 2820 3500 
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Figure 9. Aircraft gust environment for 6 ft. /sec (one sigma) intensity. 
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Mid-range gyro parity residuals, deg/hr 


8.41 


x 10' 1 



Time, sec 


b. Lightly filtered gyro parity residuals. 
Figure 10. Continued. 
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Hard-range accelerometer parity residuals. 



a. Unfiltered hard-channel residuals. 


Figure 11. Accelerometer parity residuals for evaluation trajectory. 
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Soft-range accelerometer parity residuals 


x 10 -4 



100 780 1460 2140 2820 3500 

Time, sec 

b. Filtered soft-channel residuals. 


Figure 11. Concluded. 
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Gyro thresholds, deg/hr Accelerometer thresholds. 


1.20 

0 0 
o 

1.07 

29.94 


29.91 





Figure 12. Gyro and accelerometer threshold functions for 
evaluation trajectory. 
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Soft-range gyro parity threshoia test, deg/hr 



Figure 14. Thr 



Soft-range accelerometer parity threshold test. 
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Figure 15. Threshold test results for soft-range accelerometer parity residualsT. 
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